Privacy Policy

Who We Are

This website is operated by The Cyber Detective Ltd, a company registered in England and Wales (company number 17097231). Throughout this policy, "we", "us" and "our" refer to The Cyber Detective Ltd.

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What Information We Collect

We collect personal data in the following ways:

Information you give us directly: when you contact us using the email address on this site, or make an enquiry about a keynote, workshop or briefing, you may provide us with your name, email address, organisation and any other details you choose to include in your message.

Information you give us through the Board Readiness Check: if you complete the Board Readiness Check and ask us to send you the full report, we collect your first name, last name, work email address, organisation and role, together with your answers and the scores calculated from them. This is described in full in the section below.

Information collected automatically: we use Google Analytics to understand how visitors use this website, including pages visited, time spent on site, device type and general location. This is collected in an aggregated, largely anonymised form. See our Cookie Policy for more detail on how this works.

How We Use Your Information

We use the personal data we collect to respond to your enquiries, discuss and deliver our services, and understand and improve how this website is used. We do not sell your personal data to third parties.

We do not make automated decisions that produce legal effects for you or otherwise significantly affect you. The Board Readiness Check does score your answers automatically and stores the result against your contact record, but that score is an assessment of your organisation's preparedness that you asked us to produce. It is not used to make any decision about you, and it has no legal or similarly significant effect.

The Board Readiness Check

The Board Readiness Check is a self-assessment tool. You can work through all of the questions and see your score, your pillar breakdown and your weakest pillar without giving us any personal data at all. We only collect anything if you then choose to ask for the full report by completing the form at the end.

What we collect if you request the report:

Details you enter: your first name, last name, work email address, organisation and role. All of these are required, because the report is written around your organisation and your role.

Your assessment data: the answers you selected, the score for each of the six pillars, your overall score out of 100, the score you predicted at the start, the difference between the two, how many questions you answered "I don't know", and which pillar scored lowest.

Technical data used to stop abuse: your IP address, and how long the form was open before submission. These are used to detect automated submissions and for no other purpose.

What we do with it: we generate your report and email it to you, and we store your details and scores as a contact record in our CRM so that we can follow up meaningfully rather than generically. Your individual answers are not published or shared, and we do not disclose your score to anyone outside The Cyber Detective Ltd.

Two separate permissions: the form asks you to tick two different boxes, and they do different things. The first confirms you want us to email you your report, and is needed because the report is the thing you have asked us to send. The second, which is optional, opts you in to our monthly briefing. You can have the report without the briefing, and declining the briefing has no effect on the report you receive.

Our legal basis: we rely on your consent, given separately for each of the two purposes above. You can withdraw either consent at any time using the unsubscribe link in any email we send you, or by emailing adam@thecyberdetective.co.uk. Withdrawing consent does not affect anything we did before you withdrew it. The limited anti-abuse checks described above are carried out on the basis of our legitimate interest in keeping the form from being used by bots.

How long we keep it: we keep your contact record and scores until you ask us to delete them, unsubscribe, or until you have had no contact with us for 24 months, whichever comes first. The technical anti-abuse records are kept for no more than 30 days and are then deleted automatically.

Our Legal Basis for Processing

We process enquiry data on the basis of legitimate interest, to respond to your enquiry and discuss the services you have asked about. Where we go on to provide services to you, we process data as necessary to perform that contract. Website analytics data is processed on the basis of legitimate interest in understanding and improving our website. Board Readiness Check data is processed on the basis of your consent, as described above.

Sharing Your Information

We do not sell your personal data and we do not share it with third parties except where necessary to provide our services, to comply with the law, or where we use trusted service providers who process data on our behalf under their own privacy terms and under contract with us.

The providers we currently use are:

HubSpot — our customer relationship management system, which stores enquiry and Board Readiness Check contact records. Our HubSpot account is hosted in the European Union.

Brevo — delivers the Board Readiness Check report and our monthly briefing by email.

Cloudflare — provides the Turnstile anti-bot check on the Board Readiness Check form. It receives your IP address in order to confirm the submission is not automated.

Hostinger — hosts this website and its server logs.

Google Fonts — serves the typefaces used on this site. Because the fonts are requested from Google's servers, Google receives your IP address when a page loads.

Where any of these providers processes data outside the UK, that transfer is covered by the appropriate safeguards required under UK data protection law, such as the UK International Data Transfer Addendum or a finding of adequacy.

How Long We Keep Your Information

We retain enquiry and correspondence data for as long as necessary to respond to your enquiry and, where a business relationship follows, for as long as needed to fulfil our contractual and legal obligations. We then delete or anonymise it unless we are required to keep it for a longer period by law.

Board Readiness Check records are kept until you ask us to delete them, unsubscribe, or have had no contact with us for 24 months, whichever comes first. The technical records used to detect automated submissions are deleted automatically after 30 days.

Your Rights

Under UK data protection law, you have the right to:

Access the personal data we hold about you; ask us to correct inaccurate data; ask us to delete your data; ask us to restrict or object to certain processing; and request that your data be provided to you or another organisation in a portable format.

Where we process your data on the basis of consent, as we do for the Board Readiness Check and our monthly briefing, you also have the right to withdraw that consent at any time. The quickest way is the unsubscribe link in any email we send you.

To exercise any of these rights, please contact us at adam@thecyberdetective.co.uk.

Complaints

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page.

Contact Us

If you have any questions about this Privacy Policy, please contact us at adam@thecyberdetective.co.uk.